Retainer (ongoing partnership)
- Fixed monthly/quarterly fee
- Guaranteed number of hours + priority response time (usually 1–4 h, 24/7 option)
- Continuous advisory, incident reviews, policy updates, vendor assessments, etc.
- Predictable costs and long-term security roadmap
One-off / ad-hoc consulting
- Paid per project or per day
- Performed only when a specific need arises
- No guaranteed availability or response time
Why companies choose the retainer model
- They treat cybersecurity as a process, not a one-time event
- They need an external expert “almost like an employee” but without the full-time cost
- They want someone who already knows their infrastructure, risks, and people
In practice, most law firms, manufacturers, and critical infrastructure operators in Poland that take security seriously work with me on a retainer basis.